GNU bug report logs - #35716
Password security bugs in LUKS configuration during guided install

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: sirmacik <sirmacik <at> wioo.waw.pl>
Subject: bug#35716: closed (Re: bug#35716: Password security bugs in LUKS
 configuration during guided install)
Date: Tue, 14 May 2019 10:18:02 +0000

[Message part 1 (text/plain, inline)]

Your bug report

#35716: Password security bugs in LUKS configuration during guided install 

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to 35716 <at> debbugs.gnu.org.

-- 
35716: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=35716
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Ludovic Courtès <ludo <at> gnu.org>
To: sirmacik <sirmacik <at> wioo.waw.pl>
Cc: 35716-done <at> debbugs.gnu.org
Subject: Re: bug#35716: Password security bugs in LUKS configuration during
 guided install
Date: Tue, 14 May 2019 12:17:28 +0200

Hi sirmacik,

sirmacik <sirmacik <at> wioo.waw.pl> skribis:

> I've asked on IRC if those bugs were known but apparently no, so here
> they are:
>
> - during guided installation with LUKS encryption one is not able to
>   enter password longer then length of field;

Good catch!

Commit ef250707d3303d58ae00fe8f461701e7fa788d8a fixes it for the
passphrase, the root password, and user passwords.

> - in the same field password is shown during typing (lets one see bug
>   above, characters typed after reaching length of field are simply
>   not recorded);

This has been addressed recently:
<https://issues.guix.info/issue/35540>.

Thanks for your report!

Ludo’.

[Message part 3 (message/rfc822, inline)]

From: sirmacik <sirmacik <at> wioo.waw.pl>
To: bug-guix <at> gnu.org
Subject: Password security bugs in LUKS configuration during guided install 
Date: Mon, 13 May 2019 17:09:22 +0200

Hey Guix

I've asked on IRC if those bugs were known but apparently no, so here
they are:

- during guided installation with LUKS encryption one is not able to
  enter password longer then length of field;
- in the same field password is shown during typing (lets one see bug
  above, characters typed after reaching length of field are simply
  not recorded);

Field with conformation hides typed letters. Due to bug #1 I wasn't
able to check if it works properly.

--
sirmacik
PGP: 0xE0DC81D523891771

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.